MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f50d701dfda61b1109e8fcb382385661f3ed83fceaa1c119cca23ad13c56256c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f50d701dfda61b1109e8fcb382385661f3ed83fceaa1c119cca23ad13c56256c
SHA3-384 hash: 46681cca5dabacc6f5de7e31d4753ac8bf0f2bffb38d26e07fe262ce78c53713e2a0010ba36584c2e7b1573570c49ae0
SHA1 hash: 3116a8151e905d9b14841b69d5760926f1e0680e
MD5 hash: bcc626bd77a6df74ba3ad8161e4acf4e
humanhash: shade-cat-west-oranges
File name:Звесткі пра адсочванне FedEx-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'000'527 bytes
First seen:2020-06-10 07:11:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:GHUcGpcvIeZ5D2KQYtO7IhKEkPOp0VbnLRUZBz46L7SMkEuDNBereXhfihlPpZEf:TxpHmDiYtU2uDL6ZBybz8ndeLcL4AE40
TLSH 7025338A7E9CAD1E7D74C374911A0DB7DA5498BBE34C391B3AB640811207CA9DD3F88D
Reporter abuse_ch
Tags:7z AgentTesla BEL FedEx geo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.linux61.papaki.gr
Sending IP: 138.201.206.39
From: Marta Slowinska (FedEx) <marta.slowinska.osv@fedex.com>
Reply-To: Marta Slowinska (FedEx) <dustiutd12@hotmail.com>, Marta Slowinska (FedEx) <dustiutd12@hotmail.com>
Subject: Апавяшчэнне аб дастаўцы FedEx
Attachment: Звесткі пра адсочванне FedEx-pdf.7z (contains "Звесткі пра адсочванне FedEx-pdf.exe")

AgentTesla FTP exfil server:
ftp.kassohome.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:13:04 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ugxahp5uynrccpi7szyeocwmhz63a745kq4cgomui5ncpcwevwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f50d701dfda61b1109e8fcb382385661f3ed83fceaa1c119cca23ad13c56256c

(this sample)

AgentTesla

Executable exe 5653709c36c769188c3ada80a892cba88b0ab5cb84cdd8077fadb539a25871f8

  
Dropping
MD5 fe145e41c9dc161465b9c19fc0406703
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5653709c36c769188c3ada80a892cba88b0ab5cb84cdd8077fadb539a25871f8

Comments